Sigrex API

This API uses HMAC or ML-DSA44 authentication. Every request must be signed using your API secret.

Production

Base URL

https://api.sigrex.io/api/v2

---

Getting Started

1

Create an account

Create a Sigrex account in the dashboard.

2

Generate an API key

Navigate to API Management and create a new key.

3

Sign your request

All requests must include the following headers:

Header	Description
api-key	Your public API key
timestamp	Current unix timestamp
signature	HMAC SHA256 or ML-DSA44 signature

4

Make your first request

---

Signature generation examples

Signatures are generated using HMAC SHA256 or ML-DSA44 and your API secret.

GET / DELETE requests use:

METHOD + PATH + TIMESTAMP

POST / PUT requests use:

METHOD + PATH + BODY + TIMESTAMP

HMAC SHA256 (GET request)

import crypto from "crypto"

const API_KEY = "your_public_api_key"
const API_SECRET = "your_private_api_secret"

const method = "GET"
const path = "/api/v2/strategy/llm-session"
const timestamp = Math.floor(Date.now() / 1000).toString()

const message = method + path + timestamp

const signature = crypto
  .createHmac("sha256", API_SECRET)
  .update(message)
  .digest("hex")

ML-DSA44 (GET request)

import { createMLDSA44 } from "@oqs/liboqs-js"

const API_KEY = "your_public_api_key"
const PRIVATE_KEY_B64 = "your_private_key_base64"

const method = "GET"
const path = "/api/v2/strategy/llm-session"
const timestamp = Math.floor(Date.now() / 1000).toString()

const message = new TextEncoder().encode(
  method + path + timestamp
)

const sig = await createMLDSA44()

const signature = sig.sign(
  message,
  Uint8Array.from(Buffer.from(PRIVATE_KEY_B64, "base64"))
)

const signatureB64 = Buffer.from(signature).toString("base64")

sig.destroy()

HMAC SHA256 (POST request)

import crypto from "crypto"

const API_KEY = "your_public_api_key"
const API_SECRET = "your_private_api_secret"

const method = "POST"
const path = "/api/v2/strategy/llm-session"

const body = {
  name: "My Strategy",
  cron_interval: "15M"
}

const timestamp = Math.floor(Date.now() / 1000).toString()

const payload =
   method + path + JSON.stringify(body) + timestamp

const signature = crypto
  .createHmac("sha256", API_SECRET)
  .update(payload)
  .digest("hex")
  

ML-DSA44 (POST request)

import { createMLDSA44 } from "@oqs/liboqs-js"

const API_KEY = "your_public_api_key"
const PRIVATE_KEY_B64 = "your_private_key_base64"

const method = "POST"
const path = "/api/v2/strategy/llm-session"

const body = {
  name: "My Strategy",
  cron_interval: "15M"
}

const timestamp = Math.floor(Date.now() / 1000).toString()

const payload =
  method + path + JSON.stringify(body) + timestamp

const message = new TextEncoder().encode(payload)

const sig = await createMLDSA44()

const signature = sig.sign(
  message,
  Uint8Array.from(Buffer.from(PRIVATE_KEY_B64, "base64"))
)

const signatureB64 = Buffer.from(signature).toString("base64")

sig.destroy()
  

---

Example request

curl https://api.sigrex.io/api/v2/strategy/sessions \
  -H "api-key: YOUR_API_KEY" \
  -H "timestamp: 1700000000" \
  -H "signature: GENERATED_SIGNATURE"

Never expose your API secret in frontend code. Always generate signatures on your backend.